Every authentication bypass disclosed this week came from code accepting an attacker-supplied value as proof of identity — the check ran, it just validated the wrong thing

Six disclosures inside one week, in products that share no code and no vendor, all failed the same way. None of them forgot to check. Each one checked something the attacker got to choose.

The clearest statement of the class is Apache's. The FAB auth manager's Azure AD OAuth login path decoded the OAuth-supplied ID token with the verify_signature parameter defaulted to False, so a token presented with no signature — or with alg:none — authenticated the requester as whichever user it named, the Admin role included; Apache fixed it in apache-airflow-providers-fab 3.7.3 by flipping that default, and states the Authentik path already defaulted to True (Apache Airflow security team, 2026-07-28). The token was validated. What was not validated was whether anyone had signed it.

Check Point's is the same shape one layer up in an enterprise management plane. Rapid7 found the vulnerable method preferred a caller-supplied Secure Internal Communication distinguished name over the DN bound to the authenticated peer certificate, so a client that replayed the management server's own DN was accepted as that identity with no client certificate at all, then used the resulting session to request an SSO token claiming system_admin (Rapid7 Labs, 2026-07-28). Rapid7 also records why the exposure was broad rather than a corner case: "exploitation requires network access to the Management Server and for a Trusted Clients configuration that does not restrict GUI clients, which in our testing was a default setting" (Rapid7 Labs, 2026-07-28). SolarWinds disclosed a straightforward instance of the class in Web Help Desk — CVE-2026-28323, an unauthenticated SAML 2.0 authentication bypass it scores CVSS 9.8, whose only stated precondition is that SAML 2.0 authentication is enabled, fixed in 2026.2.1 (SolarWinds, 2026-07-23).

The three Joomla extension disclosures show the class reaching its most trivial expression, and the Balbooa Gridbox pair is the only member of this group with server-log-level exploitation evidence — though not the only one exploited, since Rapid7 records the Check Point flaw as having been reported exploited in the wild as a zero-day at the time of disclosure (Rapid7 Labs, 2026-07-28). In Balbooa Gridbox, "the registration handler adds the default group to whatever groups the visitor asks for, instead of replacing them. So anyone can register a normal account and place themselves straight into an administrator group" (mySites.guru, 2026-07-29) — the request was processed correctly, and the requested privilege level was simply honoured. In JoomShaper's SP Page Builder, a request value reaches the ORDER BY clause of the Dynamic Content endpoint's query with only a Joomla anti-CSRF token in front of it — and because Joomla issues that token to every anonymous visitor on page load, a scripted attacker fetches one and replays it, making the injection effectively pre-authentication and returning the whole Joomla database including password hashes (mySites.guru, 2026-07-27). And in Aimy Captcha-Less Form Guard, the anti-spam token is base64-decoded, run through a repeating-key XOR and handed to unserialize() with no signature and no allowed_classes — while the plugin renders a ciphertext for that same keystream in every protected form, so the key is recoverable and the object forgeable (VulnCheck, 2026-07-30).

Triage: these produce authentication successes rather than failures, so a failed-login baseline will not surface any of them. The discriminators are internal inconsistency in the successful event — a session established with no corresponding client-certificate validation, an ID token accepted with an alg:none or absent signature, an account whose privilege group was set in the same transaction that created it rather than by a later administrative action, or a database-heavy request arriving with a freshly-minted anonymous session token and no prior authenticated activity. On the Joomla estate specifically, an administrator-group member whose account creation timestamp matches its group assignment timestamp is the artifact Gridbox exploitation leaves behind.